Industry Day Q&As_dtd 08 June 2018.pdf

SPAWARSYSCEN Atlantic CYBER RED TEAM AND OPERATIONAL TEST SUPPORT

N65236‐16‐R‐0032

Pre‐Acquisition Planning Industry Day Q&As

1. Will the attendee list be published in e‐Commerce/FedBizOpps?

Yes, we will provide a list of companies that attended this event. This has been included as a separate attachment to this posting.

2. Will the Government consider non‐DCAA/CPFF contract format?

No. Based on the unknown and undefined nature of the individual task order requirements, utilization of a cost type (i.e. CPFF) contract is required.

3. Will there be any restrictions on how many proposal submissions a company can be listed as a subcontractor?

No. However, the tentative RFP will include the requirement for offerors to submit a written teaming agreement disclosure form to be signed by both parties.

4. Is there a possibility the $5M invoicing requirement may be relaxed?

The $5M invoicing requirement is currently under review. The final RFP will identify the Government’s final decision regarding this invoice threshold requirement.

5. Can you describe in more depth the past performance evaluation (specifically how many)?

The past performance references are based solely on the contract references submitted.

At this time, the Government estimates that up to eight (8) past performance references will be permitted. This number (of past performance references) is subject to change and therefore you will want to refer to the formal solicitation that is posted for specific information.

6. Why is this procurement a Service Disabled Veteran‐Owned Small Business

(SDVOSB) and not a Small Business (SB) or Full and Open?

Based on the Sources Sought Notice responses and the market research findings, it was determined that at least 2 SDVOSBs were capable of performing the requirements.

7. Is this work truly $50 ‐ $100M in value?

Yes. The Government anticipates the IDIQ ceiling to be approximately $99M.

8. Are you still accepting market research input? Who is the POC?

No. The period to accept market research is closed.

9. Will résumés be required at submission?

The final evaluation factors are in development and may include résumés. The

Government’s decision will be reflected in the final RFP

10. Who is the incumbent / Which vendor(s) are currently supporting the

SPAWAR Red Team now?

KSH Solutions, Inc. (now ECS Federal) has performed a small subset of this requirement.

However, this is a new requirement and therefore there is no incumbent for this requirement.

11. Can we use CLASSIFIED contract references in an UNCLASSIFIED proposal?

The Government is currently reviewing the potential for the submission of classified contract references. The Government’s final decision will be identified in the final RFP.

12. Is SPAWAR using the SeaPort‐e contracting vehicle for this effort? I believe the mandated NAICS for SeaPort is 541330.

No. The Government will NOT be utilizing SeaPort‐e for this effort. As stated in the Pre‐

Acquisition Planning Industry Day presentation, the solicitation will be released on the

SPAWAR e‐Commerce website and FedBizOpps. The NAICS code chosen for this specific requirement was based on the appropriate Product Service Code (PSC) ‐ D310. The corresponding and applicable NAICS code is 541519 – Other Computer Related Services.

13. For joint ventures, will the past performance of both companies be taken into account or just the past performance that the joint venture has done as the joint venture (i.e. the joint venture is a SBA‐accredited mentor‐protégé JV)?

In accordance with CFR §125.18 (b)(5), it states that when evaluating the past performance and experience of an entity submitting an offer for a Service Disabled

Veteran Owned (SDVO) contract as a joint venture established pursuant to this section, a procuring activity must consider work done individually by each partner to the joint venture as well as any work done by the joint venture itself previously.

13.1 Additional Question: How will the Government evaluate past performance if:

a) Only 1 company of the JV has relevant past performance

b) The JV itself does not have relevant past performance

The Government will evaluate the contract references/past performance proposed by the Joint

Venture entity. As the joint venture is a legal entity, the experience of the two partners in the joint venture can be proposed to meet the solicitations contract reference/past performance individually, or as the JV, or both. However, any and all submitted contract references must demonstrate experience relevant and recent to the solicitation’s technical requirements in order to be evaluated.

It is also noted the JV will be required to submit proof that the JV has been approved and certified by the SBA with the proposal in order to validate the proposed JV is a legal entity.

14. Can a joint venture prime if they do 50% of the work?

A Joint venture is a legal entity in the nature of a partnership engaged in the joint prosecution of a particular transaction for mutual profit. Since they are one entity, the performance of the two partners in the joint venture can satisfy the limitation on subcontracting requirements of 50% or more as required by 13 C.F.R. 125.6. However, the joint venture must also meet the work allocation requirements of 13 C.F.R. 125.18(b)(3) summarized below:

13 C.F.R. 125.18(b)(3) - Performance of work.

(i) For any SDVO contract, including those between a protégé and a mentor authorized by § 125.9 or §

124.520 of this chapter, the joint venture must perform the applicable percentage of work required by

§ 125.6.

(ii) The SDVO SBC partner(s) to the joint venture must perform at least 40% of the work performed by the joint venture.

(A) The work performed by the SDVO SBC partner(s) to a joint venture must be more than administrative or ministerial functions so that they gain substantive experience.

(B) The amount of work done by the partners will be aggregated and the work done by the SDVO SBC partner(s) must be at least 40% of the total done by all partners. In determining the amount of work done by a non-SDVO SBC partner, all work done by the non-SDVO SBC partner and any of its affiliates at any subcontracting tier will be counted.

In summary, the SDVOSB partner to the joint venture, must perform at least 40% of the work proposed to be performed by the joint venture.

15. Is this “as required” work or will the staff be 100% tasked during the contract?

The staffing requirements will be identified at the individual task order level. However, there may be a requirement for Key Personnel at the time of award. The Government’s decision will be identified in the final RFP.

16. The Pentagon has embraced Secure Crowd‐Sourced Penetration Testing (hack the Pentagon) as well as the Army, Air Force, and DiSA. Is the Navy Red Team open to this approach?

Yes; however, it must meet the requirements of the RFP (i.e. provided it was done in support of a certified Red Team).

17. What size of team / Full‐time Equivalents (FTEs) will this be?

It is anticipated that the size of the team will be 8‐10 per task order but could also increase to up to 100 FTEs based on the requirements of individual task orders, concurrently executed.

18. Can penetration testing experience count as Red Team experience?

Yes, only if it was done in support of an accredited Red Team.

19. Please confirm if the Government will accept examples of experience from commands outside the 9 NSA‐certified Red Teams as relevant experience https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=28ecffbfcc51433405558dc74cf1be8f&term_occur=19&term_src=Title:13:Chapter:I:Part:125:Subpart:C:125.18 https://www.law.cornell.edu/cfr/text/13/125.9 https://www.law.cornell.edu/cfr/text/13/124.520 https://www.law.cornell.edu/cfr/text/13/124.520

The Government requires that all contract reference examples of experience identify experience supporting a DoD accredited Cyber Red Team.

20. What risk management framework support is required by the Red Team to operate the infrastructure?

It varies based upon the number and types of system necessary to conduct and sustain the Red Team operations.

21. Is a level 3 CMMI certification required? If so, what level and in what capabilities? Must the Prime hold the CMMI certs?

The CMMI certification is not a requirement, but may be considered a benefit to the

Government if certified at level 3 or higher.

22. How are you handling OCI with DT/OT services? For example, there may be a situation where a contractor could be designing software for the Navy under another contract (OT) and then testing their own work under this contract.

The Government is evaluating this potential and will include any necessary organization conflict of interest clauses in the final RFP, if warranted.

23. Do you expect to expand into close access operations to access physical security?

Yes. It is anticipated for this to occur no later than the next inspection (March 2020).

24. Must the Prime have a TS facility clearance (FCL)?

Yes. This FCL clearance level is required at the time of award.

25. Please confirm the Government will allow team members who have valid capabilities outside of the 9 NSA‐certified Red Teams to join a prime who has experience with a certified Red Team.

All submitted contract reference experience shall cite experience supporting a DoD accredited Cyber Red Team.

26. What are the local off‐site requirements, if any?

The local off‐site requirements will be determined at the task order level. At this time, the Government anticipates this to be 3,000 – 5,000 square feet.

27. What internal training is conducted or expected to be conducted on the Red

Team?

There are SPAWARSYSCEN Atlantic Red Team operator levels that individual team members can attain by participating in the Red Team’s formal training program.

Individuals must attain and maintain a “Level 1” to conduct operations on the team.

There are currently four (4) levels. Each Red Team service area is assessed uniquely

(e.g. local, remote, wireless, etc.).

28. What are the minimum and expected individual certifications for Operators?

Developers?

The minimum and expected individual certifications that an Operator and Developer shall possess is CSSP Auditor defined in DOD 8570.01-M and found here: https:// iase.disa.mil/iawip/Pages/iabaseline.aspx.

29. What is the nature of the infrastructure support required?

The nature of the infrastructure support required includes the security of operations and support of the infrastructure (hardware, software, laptops, servers, testing gear) used by the Red Team operators to safely conduct assessments.

30. Will you have infrastructure in the cloud?

Yes. Infrastructure will be in one or more cloud service providers.

31. Can the JV (Joint Venture) leverage the TS FCL of the partner if the SDVOSB firm only has a Secret

FCL

No.

32. Also can the JV leverage the certified CPFF Accounting System if the SDVOSB firm doesn't have one?

The JV must be an SBA approved and certified JV. The JV would utilize the approved accounting system of the JV in accordance with the JV terms and conditions.